compilation fails

[f0restw0w]

jni/main.c: In function 'writemsg':
jni/main.c:88:9: error: variable 'msg' has initializer but incomplete type
jni/main.c:88:9: error: extra brace group at end of initializer
jni/main.c:88:9: error: (near initialization for 'msg')
jni/main.c:88:9: warning: excess elements in struct initializer [enabled by default]
jni/main.c:88:9: warning: (near initialization for 'msg') [enabled by default]
jni/main.c:88:9: warning: excess elements in struct initializer [enabled by default]
jni/main.c:88:9: warning: (near initialization for 'msg') [enabled by default]
jni/main.c:88:17: error: storage size of 'msg' isn't known
jni/main.c:89:9: warning: missing initializer [-Wmissing-field-initializers]
jni/main.c:89:9: warning: (near initialization for 'soaddr.sin_port') [-Wmissing-field-initializers]
jni/main.c:96:2: warning: implicit declaration of function 'socket' [-Wimplicit-function-declaration]
jni/main.c:96:27: error: 'SOCK_DGRAM' undeclared (first use in this function)
jni/main.c:96:27: note: each undeclared identifier is reported only once for each function it appears in
jni/main.c:103:2: warning: implicit declaration of function 'connect' [-Wimplicit-function-declaration]
jni/main.c:116:3: warning: implicit declaration of function 'sendmmsg' [-Wimplicit-function-declaration]
jni/main.c:88:17: warning: unused variable 'msg' [-Wunused-variable]
jni/main.c: In function 'getpipes':
jni/main.c:229:26: error: 'F_SETPIPE_SZ' undeclared (first use in this function)
make.exe: *** [obj/local/armeabi-v7a/objs/iovyroot/main.o] Error 1
make.exe: *** Waiting for unfinished jobs....

[dosomder]

What toolchain are you using? Try with Android NDK r10e. Looks like you're missing some headers.

[wangqize]

I met the same problem too . i have fixed the problem with
:
#include sys/socket.h
#include unistd.h
struct mmsghdr {
struct msghdr msg_hdr;
unsigned int msg_len;
};
in Android NDK r10b

but when i run the code(my phone is hm-2a (xiaomi, linux-3.10, 4.4.4)), and got error:

• func(): bad address

and i try disable the code:
//ret = (fcntl(pipefd[1], F_SETPIPE_SZ, PIPESZ) == PIPESZ) ? 0 : 1;
//if(ret)
//perror("fcntl()*********************");

and pass the error.
so my question is : Is the fcntl call nessassry and what is it func? thanks

[dosomder]

It's to increase the pipe buffer. I don't think it's crucial for the exploit

If you are compiling for Android 4.4. you should adapt Application.mk. Then you would probably get compile errors instead of runtime errors.

[f0restw0w]

APP_PLATFORM := android-20 :

**** Build of configuration Default for project iovyroot ****

[armeabi-v7a] Compile arm : iovyroot <= main.c
jni/main.c: In function 'writemsg':
jni/main.c:90:9: error: variable 'msg' has initializer but incomplete type
struct mmsghdr msg = {{ 0 }, 0 };
^
jni/main.c:90:9: error: extra brace group at end of initializer
jni/main.c:90:9: error: (near initialization for 'msg')
jni/main.c:90:9: warning: excess elements in struct initializer [enabled by default]
jni/main.c:90:9: warning: (near initialization for 'msg') [enabled by default]
jni/main.c:90:9: warning: excess elements in struct initializer [enabled by default]
jni/main.c:90:9: warning: (near initialization for 'msg') [enabled by default]
jni/main.c:90:17: error: storage size of 'msg' isn't known
struct mmsghdr msg = {{ 0 }, 0 };
^
jni/main.c:98:2: warning: implicit declaration of function 'socket' [-Wimplicit-function-declaration]
sockfd = socket(AF_INET, SOCK_DGRAM, 0);
^
jni/main.c:98:27: error: 'SOCK_DGRAM' undeclared (first use in this function)
sockfd = socket(AF_INET, SOCK_DGRAM, 0);
^
jni/main.c:98:27: note: each undeclared identifier is reported only once for each function it appears in
jni/main.c:105:2: warning: implicit declaration of function 'connect' [-Wimplicit-function-declaration]
if (connect(sockfd, (struct sockaddr )&soaddr, sizeof(soaddr)) == -1)
^
jni/main.c:90:17: warning: unused variable 'msg' [-Wunused-variable]
struct mmsghdr msg = {{ 0 }, 0 };
^
jni/main.c: In function 'getpipes':
jni/main.c:232:26: error: 'F_SETPIPE_SZ' undeclared (first use in this function)
ret = (fcntl(pipefd[1], F_SETPIPE_SZ, PIPESZ) == PIPESZ) ? 0 : 1;
^
make: ** [obj/local/armeabi-v7a/objs/iovyroot/main.o] Error 1

**** Build Finished ****

[wangqize]

Try with Android NDK r10e.
and add
#include sys/socket.h
#include unistd.h
in the main.c